New Targeted E-mail Attack Hits Business Execs 100
Erik Larkin writes "The same scammers who have been sending out the faked but highly convincing BBB and IRS e-mails are now targeting named victims with a new variety of e-mail that looks like a business invoice. Our editor-in-chief was sent one here at PC World."
Money to be made (Score:5, Funny)
It's about time... (Score:4, Interesting)
Re: (Score:2, Insightful)
Best practice or not, it simply will. not. happen.
Re: (Score:2, Funny)
Not going to happen.
Best practice or not, it simply will. not. happen.
i don't see why not. i'm thinking i might implement this at work next week, we can easily put our public key on the "about us" page as a matter of customer protection against fraud. it's not a big deal to sign all out outgoing mail. its not something that could have any problems, if antthing, i've noticed the mere signing of email causes outlook to put a nice rosette against the mail, so it can't possibly cause any problems for us.
Re: (Score:2)
First of all, it would be a lot of work to convince your managers that it's necessary, and you're putting your job at risk with it, too. The reason is simple: You will be responsible when something bad happens regardless. And it will. Because you said it's safe. Not to mention that you put burden on your manager, someone who can make your life rather miserable quite easily,
Re: (Score:1, Insightful)
And for what it's worth, I have a Linux box myself - and I work in IT for a Fortune 100 company. I know what it takes to deploy and support applications on a big scale.
While Linux may in fact be a better option, in almost every case, it's just not a practical one, and in business, you have to do what makes the most sense for the most people from a practicality standpoint, though I'm sure some people will beg to differ wi
Re: (Score:2, Insightful)
Re: (Score:2)
Why is this sophisticated? (Score:4, Informative)
Re: (Score:2)
Re: (Score:3, Informative)
Similar to this one...
-Years ago, we used to have guys that would come to "check" the fire extinguishers in the office.
-They would do their thing, and wait for the receptionist to pay from petty cash.
-Only problem... They weren't OUR fire extinguisher guys.
-We sometimes would get guys coming around every other week.
Re:Why is this sophisticated? (Score:5, Insightful)
Not if either of two conditions apply.
1: You are an idiot with computers.
2: The default 'do not show file extensions for known file types' is on for explorer.
Whoever thought that last was a good plan should have been shot. Without file extensions visible, people can simply not realise that they are about to run an executable. Plus some wouldn't know all the many executable file extensions for windows anyway.
Re:Why is this sophisticated? (Score:4, Informative)
Whilst this is annoying (I disable it as I like to SEE my files' extensions), it doesn't prevent you checking for 'trick' filenames, actually. Any filename that appears to have an extension ('mywork.doc') has a double-extension, so you should be VERY suspicious.
Re: (Score:2, Insightful)
Re: (Score:2)
Re: (Score:3, Informative)
It's trivial to add an arbitrary icon to an executable. Actually, that's a feature of pretty much every standard compiler on Windows.
Re: (Score:3, Insightful)
That shouldn't even matter. Why can they run anything? Why is Outlook allowing them to open exe files?
If #1 is true (it is where I work, a gov agency, different country), then don't let them make decisions on whether to open a file, have the system do that. You don't let mentally retarded people drive a car, so why let you average idiot choose what to run on a computer?
Re: (Score:2)
Because saving it and executing it from explorer is first of all actually a non-trivial task for those people and it wouldn't help at all.
Imagine file extensions are turned off. So bogus_file.doc.exe is shown as bogus_file.doc, and has a Word-document like icon. When that file is now saved, it will appear as bogus_file.doc in the explorer.
Re: (Score:2)
Every system I've ever installed for clients blocks executables at the server and puts them into quarantine. Occasionally some doofus, sadly usually some IT consultancy, wants to send an
Re: (Score:2)
Re:Why is this sophisticated? (Score:5, Funny)
1: You are an idiot with computers.
2: The default 'do not show file extensions for known file types' is on for explorer.
But these are the same people who click "Allow" when their software firewall says "H4xoR!tR0jun.exe is attempting to access the Internet, install a malicious script, steal your personal information and have sex with your wife until she screams like a deaf girl. Permit or Allow?" There is no way to protect these people and still have their computers be useful/enjoyable for them.
You don't need to. (Score:5, Insightful)
You don't need to.
As long as the protections cause the rate of infection to drop below the rate of disinfection, the threat will fade.
Social engineering will always be an issue. Even intelligent people can make mistakes.
The idea is to make it as obvious as possible that this is a DANGEROUS activity
Make it as easy as possible to clean up the mess.
#1. Any time an application is launched by clicking on a file INSTEAD of going through the menu bar throw up a warning.
#2. No email program should EVER run ANY executable.
That is the primary reason that so few "viruses" exist in the wild
#1. Save the attachment to your personal directory.
#2. Change the permissions on the file to be executable.
#3. Run the file.
And even with all of that the only thing in danger are your personal files (you do back them up of course). To do anything more you'd have to...
#4. Suppy it with your sudo password.
The reason this is so successful is that the possibility of FAILING to run the "virus" goes UP with each step that is required. Say that each step only has a 50% possibility of being run by the average user. The other 50% of the time they realize that they're doing something dangerous and they stop.
A. Old Windows example:
#1. Double-clicking on "sex.gif" in an old version of Outlook is a single step and will succeed with 50% of the people.
B. Linux example:
#1. Saving the file to your personal directory will work with 50% of the people.
#2. Changing the permissions on the file will work with 50% of the people from step 1 (25% of the total).
#3. Clicking on the file will work on 50% of the people from step 2 (12.5% of the total)
#4. Supplying the sudo password will work on 50% of the people from step 3 (6.25% of the total).
So, 50% infection rate vs a 93.75% NON-infection rate.
Re: (Score:2)
#1. Any time an application is launched by clicking on a file INSTEAD of going through the menu bar throw up a warning.
This just worsens the problem. If you throw warnings and dialog boxes at people constantly, then they just stop reading them, and always click "Ok" or "Yes." It's not just a terrible idea, it's actually counterproductive. It's a massive problem with Windows, which seems to throw dialog boxes at you every 5 seconds for the most trivial of operations. I've seen "Are you sure you want to do the command you just asked me to do" boxes on the most stupid things.
Re: (Score:1)
Re: (Score:2)
The only thing people noticed when those "pesky" popups appear is that whatever they want to do only works if they say "allow" all the time. So when in doubt, they will "allow". Reason: They learned that their network suddenly stopped working after a windows update where some DLL got changed which was a necessity to make the DNS service work, but they said "deny" when it tried to contact the DNS server.
Learning effekt: Better say yes
Social engineering in Linux (Score:2)
They get a mail, claiming the attachment enables them to run HD content under Linux, it's some supersecret, hacked AACS key thingamajig, the text makes it look like it was supposed for someone else so the lucky winner of the HD player thinks he hit the jackpot.
Included are detailed instructions what you got to do to make it run, which includes sudo'ing.
Bet you my computer against an abacus that it will work. The security of a sys
Re: (Score:3, Funny)
Re: (Score:2)
Well, what would you click? No, I won't provide info what program tried to access what address on what port, because the sentence above is exactly the information an untrained user gets out of the message! The only information he has is that something tried to do something with a server somewhere on the 'net. Is it a system dll that does some periodic check of something? Is it a scheduled task (ok, he won't even think of that)? Is it a tr
Re:Why is this sophisticated? (Score:5, Funny)
Re: (Score:2, Funny)
That is one hell of a descriptive (albeit true) firewall advisory message. What software firewall are you using?
Re: (Score:1)
Fscker.
Re: (Score:2)
Interesting. However it won't ever appear in windows, and L
Re: (Score:2)
Re: (Score:2)
Wake-up call? (Score:1)
Re: (Score:1)
Re: (Score:2)
They used to do it with faxes, (Score:4, Insightful)
and before that they used the regular mail.
So this is news because .... they used computers .... and .....email.
Re: (Score:1)
They used to do it ... (Score:2)
Quick, apply for a patent! (Score:1)
Looks like it has all the components to be patentable.
Re: (Score:2)
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
Ok, I can see how regular mail could be used to spread viruses, but faxes? Are we talking about a Snowcrash scenario here?
Why not just send out business invoices? (Score:3, Insightful)
Re: (Score:2)
Re: (Score:2)
It also helps to keep the amounts small as well as perhaps add a late payment charge, so the person getting the bill is worried they might be in trouble if they make the bill late.
Checking out the 'from' address... (Score:4, Informative)
Doesn't help in the slightest.
Don't people know by now that the 'from' address can be easily changed?
(That was a rhetorical question; they answer is evidently 'no'.)
Re: (Score:2)
Re: (Score:2)
Er. The question was "don't people know that it can be faked", to which the answer was "no"; meaning no, people don't know that it can be faked, not, no, people don't know that it can't be faked.
Sorry for the confusion. But, to be clear, I do know that it can be faked. It's just most people don't.
Re: (Score:2)
Re: (Score:2)
Oh.
That was my first thought, but then I realised there actually was potential for confusion, and you didn't give any sarcasm hints ;)
Why bother faking it? (Score:2)
The from-address read: "Lawyer". No name, no address, no reply-to address, just "Lawyer". And people fell for it in heaps.
People are stupid. Deal.
Here's a pretty good description (Score:3, Informative)
http://avinti.com/press-room/targeted-malware-att
Sorry, the actual details are here (Score:3, Informative)
Re: (Score:2)
Ok, so to infe
Small business owner (Score:5, Informative)
I was wondering how long before the crooks realized that most businessmen do not have the time or patience to study their bills.
Re:Small business owner (Score:5, Funny)
Re: (Score:2)
Re: (Score:2)
- Fake invoices from "phone books" for ads (that said in tiny little print that it was not a bill, thereby making it legal rather than mail fraud.)
- Phone calls from someone claiming to be my regular supplier of printer or copier supplies, offering to sell them "before the price goes up"
- Similar phone calls to the last for air hoses and a variety of other industry-specific stuff.
The new thing here appears to be that, rather then profi
Re: (Score:2)
These people obtain a name of an employee, and just send it, with the unsuspecting employees name as a PO. Then they bill it, hoping accounts payable will just pay it.
Antivirus caught double extension right away (Score:1)
Please help! (Score:3, Funny)
Re: (Score:2)
Blue Security tried that with spam (Score:2)
Hard work (Score:5, Insightful)
Its not as if you could use heuristic scanning of the text content (any malicious payload excepted) to determine that messages of this sort are spam, it would prevent you from recieving any business related email that follows a similar formula and they are all pretty similar.
The attachment in this case was a doc.exe which is fairly obviously dodgy, but as the article states it could be a
With this type of spam and the zero day vulnerability as the scenario it would be entirely possible for a message like this to get through to a real person, for that person to open the attachment and execute whatever malicious code is embedded in the attachment without realising that they have even done anything strange.
There is no way of preventing it that still allows your employees to function, with a 0 day you are (probably) not going to detect the payload before it is executed (what happens then depends on what precautions your company is taking). You cannot brief your user base not to open emails addressed to them with content that looks valid and may be part of their job to look at, the argument of only opening mail from people you know only really works in a social context where you can afford to ignore mail.
So, up until now most common scams and viral mail have had some tell-tale characteristics (although by no means all, custom attacks against specific targets have followed this model before), and now they may not have. (I never understood why spam was so poorly produced in any case). Given that even badly written and almost blindingly obvious spam and scams manage to trick a small number of people, this type of spam or scam is likely to be more effective. This leads me to think that from a business point of view (lets be honest, especially a Microsoft shop) the usefulness of email is seriously deteriorating, it is approaching the point where the existing system contains too much risk and is too overburdened to be useful and that is saying a lot because email really was/is a revolutionary technology. Not that I can think of an alternative nor am I suggesting that we will see business dropping email, but I can see business looking at some of those fatally flawed but great sounding add-ons that aim to secure mail from unknown recipients (micro payments and white listing etc..).
Re: (Score:2)
Yes there is. By default sequester all downloaded content to a sandboxed environment with very limited access rights to anything (such as no access to other files, and no access to the network without being given explicit permission for every action). Making functionality to make that trivial to do would be a killer app for virtualization technology. For most users, having a shared clipboard to cut and paste data, images and o
Re: (Score:2)
By default sequester all downloaded content to a sandboxed environment with very limited access rights to anything (such as no access to other files, and no access to the network without being given explicit permission for every action). Making functionality to make that trivial to do would be a killer app for virtualization technology.
My point is you are going from a useful technology i.e.
1) get email, it has a power point attachment, Open the power point attachment, modify it save it send it back...
2) get an email, have it quarantined, now you cannot do anything with it.
After all accessing it with a suitable reader application would threaten that application, if you are suggesting running the application that opens the attachment in a sandboxed environment then you need to realise that things like external media sources embedded in fil
The circle of life... (Score:3, Interesting)
Where I work we had to implement draconian measures concerning attachments and files because the execs kept clicking "run anyway" even though the anti virus software warned them it could be an infected file. They honestly thought they knew more than the AV software.
Re: (Score:2)
That's really mean (Score:2)
Good Thing? (Score:4, Interesting)
I think maybe this is a good thing. I think the scammers have been, to this point, largely targeting the gullible. Old people, drug abusers, the socially awkward. The problem with that is those sections of our society are, I would guess, significantly underrepresented in the political process.
If the friends and contributors of our ruling elite class start getting tagged, perhaps we will see some Internet legislation that is focused on taking out the really vile scum, instead of just the low grade malefactors that infringe copyright for personal use. Copyright legislation is going gangbusters because the people Congress talks to believe it is good. If those same people start to feel the bite of scammers, maybe they'll get serious about finding these assholes and putting them away.
Re: (Score:2)
You think that'd be a good thing? (Score:2)
We'd probably get some new unenforcable laws, or insane punishments on existing unenforcable laws, and on top of it some laws that won't even address the issue but make the life of the whitehats even more uncomfortable than it already is, to the point where the only one who'll still be able to dete
I won't believe it. (Score:2)
EXE embedded in DOC, not .doc.exe (Score:4, Informative)
If you work corporate security, make sure you are watching for signs of the data exfiltration on the network. I've written some Snort IDS signatures which are available here:
http://www.secureworks.com/research/threats/bbbph
FTFA: Editor-in-Chief Harry McCracken (Score:2)
Business ID (Score:1)
Re: (Score:1)
Re: (Score:1)
Re: (Score:1)
If somebody paid money for the ad, it is more likely traceable. Plus, they can do this anyhow now with a company name.
I had a similar idea (Score:2)
It's astonishing how many of them will say things like "I dunno" or "Oh, it's broadband" or "There's a box that says Netgear, does that help?" If they don't know sometimes I press a little: "Well, do y
Email as file transfer (Score:2, Interesting)
Yeah....Did you...Did you get the memo? (Score:1)